Jun Harada

Ex-Growth + Communication at @signalapp

[Nav Toor @heynavtoor]

In 2020, an Israeli digital intelligence company named Cellebrite told the world they could crack Signal.

Signal is the world's most secure messaging app.

Cellebrite sells phone-cracking tools to the FBI, ICE, Saudi Arabia, Russia, and over 60 governments. They charge millions per contract. Police use their devices on protestors, journalists, and dissidents.

So when they bragged on their blog about breaking Signal, the man who built Signal got curious.

His name is Moxie Marlinspike.

A few months later, Moxie wrote a now-legendary blog post.

It started with a sentence no one expected.

"By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me."

Inside the package was a complete Cellebrite forensic device.

He took it home. He opened it. He reverse-engineered the software the FBI uses to break into your phone.

What he found was embarrassing.

The software had massive security holes. Old code from 2012. No protection against malicious files.

In simple terms, any app on a phone could plant a hidden file that would take over the Cellebrite machine the moment it scanned that phone.

Once the machine was hijacked, Moxie could rewrite every report Cellebrite had ever generated. Every police case. Every court submission. Every piece of digital evidence.

Then he published the exploits on the internet for free.

Cellebrite's stock dropped. They quietly removed Signal from their list of supported apps a week later.

Here's the wildest part:

The same man who hacked the FBI's favorite phone-cracking company also built the encryption that protects three billion people every day.

WhatsApp uses Moxie's encryption.
Google Messages uses Moxie's encryption.
Facebook Messenger uses Moxie's encryption.

Three billion people. One man's code. Given away for free under the AGPL-3.0 license.

The FBI publicly admitted in court they cannot break Signal. Bill Barr personally complained about it. The DOJ tried to legally force Signal to add a backdoor. Signal said no.

Mark Zuckerberg uses Signal personally. Edward Snowden uses Signal. Every privacy researcher on Earth uses Signal.

The repo is signalapp/Signal-Android. 28,000 stars. No ads. No tracking. No phone number leaks. No backups stored on any company's server.

Just messages between two phones, that no government on Earth has ever been able to read.

100% Open Source.

(Link in the comments)

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

Hackers showed me (there's video) how a web bug let them locate, unlock, honk the horn, start ignition of any of millions Kias in seconds, just by reading a car's license plate.

They found similar bugs for a dozen carmakers over the last two years.

https://t.co/ww9SrV17Xk

[Freedom of the Press Foundation @FreedomofPress]

🎉 Happy 10th anniversary, @signalapp!

In the app’s early years of development, @freedomofpress proudly served as the "fiscal sponsor" of Signal.

We regularly recommend it to journalists as the best end-to-end encrypted messenger that exists.

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

For the 10th birthday of Signal, I did a Big Interview with its president @mer__edith.

We ended up talking about how her focus for Signal goes beyond encryption or privacy, to creating an alternative to surveillance capitalism—or even capitalism, period.
https://t.co/kAj3uEL9sX

[Co.Design @FastCoDesign]

What if a stage 4 cancer diagnosis wasn't a death sentence, but an invitation to live the way you've always wanted to live? For creative director Nathan Phillips, his diagnosis was a chance to change the way he—and others—think about cancer. https://t.co/cPvYcZTsxm

[Brian Merchant @bcmerchant]

The generative AI era truly is wild, just surveillance capitalism roided out and put on autopilot

[Axios @axios]

. @signalapp President @mer__edith explains why an encrypted confidential messaging system matters:
#AxiosAISummit

[Amba Kak @ambaonadventure]

This essay is about much more that the Tik Tok bill and will make many of us that work on "policy" deeply uncomfortable.

Read @mer__edith for (always) opening up hard conversations that it's much easier for many of us not to have https://t.co/DYpg34ZxAA

[James Brandt @j_e_brandt]

"It is dangerous to treat nation-states like home teams, without acknowledging that these forms are containers, whose function is to hold power over subjects, and that those wielding power from within these structures can do so benevolently, or with unspeakable brutality."

[Meredith Whittaker @mer__edith]

📢NEW FROM ME!

On the TikTok ban, the danger of abandoning defense of speech to extremists, & how the liberal tendency to assume a just state "outside the scope of this paper" leads to confused law/policy that can exacerbate the problems platforms pose.

https://t.co/Pk4LNE1Lc2

[Meredith Whittaker @mer__edith]

Happening in 15 minutes, and online after!

I’ll be speaking for the first time publicly on new research, arguing that we actually lost the crypto wars, and that understanding why can help us win against threats to e2ee and secure meaningful privacy for people more generally 😇❤️

[Nina Corcoran @Nina_Corcoran]

Pitchfork is losing actual legends with these layoffs, people whose work is a treasure trove of criticism and insight that's changed how I view music, both as a fan and a writer. To honor their last day, here are my favorite pieces by everyone:

[Signal @signalapp]

New long-sleeve shirts and tote bags fresh from the Signal test kitchen!

Shirts are available in S - 3XL in Natural & Black. Totes are available in Black.

https://t.co/xwY3umZh9d

[Meredith Whittaker @mer__edith]

UGH. Please read, share, call.

Fighting for privacy can be wearying, feel defeating, but we need to fight this latest attempted mass surveillance ratchet turn, working to make all of our devices, and the infra they rely on, into snitches.

This is not a world we can accept.

[Meredith Whittaker @mer__edith]

PSA: We've received questions about push notifications. First: push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages or calls–not to Apple, not to Google, not to anyone but you & the people you're talking to. 1/

[Brian Merchant @bcmerchant]

And finally, bringing things home with the Silicon Valley export she wishes did not exist this year, here's @Mer__edith Whittaker:

[Brian Merchant @bcmerchant]

As the year draws to a close, and we're bombarded with 'best tech gifts' promotions and listicles, I convened an esteemed panel to consider the tech we wish did *not* exist this year. Presenting,

The Worst Tech of 2023 — an anti-gift guide

https://t.co/iTbpUUG1RM

[Signal @signalapp]

You can donate to Signal on behalf of a friend. You support Signal & they can choose to display a badge on their profile. Kill two birds with one stone or feed two birds with one seed depending on your tolerance for metaphorical bloodlust.

Settings > Donate > Donate for a Friend